"anonymous <rstcoders.com> wrote:

> At the 5th of September Qualys released a Security Warning regarding a Linux
> based virus. This virus was called the "Remote Shell Trojan" (RST) and it
> attacks Linux ELF binaries. It has replicating abilities: when run it will
> infect all binaries in /bin and the current working directory. Besides that
> it also spawns a process listening on UDP port 5503. When a properly crafted
> packet is received by this process it will connect back with a system shell.
<<snip>>

To the best of my knowledge, neither Qualys nor yourselves (or anyone
else) has provided samples of this virus to the usual antivirus
research community. You are more likely to have a fix for this virus
reach where it is needed through those established and now fairly
well-honed delivery systems than by posting to a public mailing list.

If you or Qualys wish to provide such samples to the antivirus
research community, please send the samples where you would normally
send virus samples. If you do not have a preferred vendor or
vendors, here is a list of the sample submission addresses of the
better known antivirus developers -- please choose the vendor(s) you
feel happy trusting such code to and supply them with a sample:

   Command Software <viruscommandcom.com>
   Computer Associates (US) <viruscai.com>
   Computer Associates (Vet/IPE) <ipevirusvet.com.au>
   DialogueScience (Dr.Web) <Antivirdials.ru>
   Eset (NOD32) <trnkaeset.sk>
   F-Secure Corp. <samplesf-secure.com>
   Frisk Software <viruslabcomplex.is>
   Kaspersky Labs <newvirusavp.ru>
   Network Associates (US) <virus_researchnai.com>
   Norman (NVC) <analysisnorman.no>
   Sophos Plc. <supportsophos.com>
   Symantec <avsubmitsymantec.com>
   Trend Micro <virus_doctortrendmicro.com>

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]